CITY OF SANTA MONICA · City of Santa Monica Internal Controls Testing: Cash Handling Final Report...

January 10, 2017

Prepared by:

Moss Adams LLP

999 Third Avenue Suite 2800

Seattle, WA 98104 (206) 302‐6500

FINAL REPORT FOR

CITY OF SANTA MONICA

INTERNAL CONTROLS TESTING: CASH HANDLING

City of Santa Monica Internal Controls Testing: Cash Handling Final Report 01-10-17 | i

TABLE OF CONTENTS

I. OVERVIEW 1 A. BACKGROUND 1

B. SCOPE AND METHODOLOGY 1

C. SUMMARY 2

II. RESULTS 4

III. APPENDIX: EXAMPLE FORMS AND PROCEDURES 19 EXAMPLE 1 – UNANNOUNCED CASH COUNT PROCEDURES 19

EXAMPLE 2 – CHANGE FUND AND CASH DRAWER AUDIT 20

EXAMPLE 3 – PETTY CASH AUDIT 22

City of Santa Monica Internal Controls Testing: Cash Handling Final Report 01-10-17 | 1

I. OVERVIEW

A. BACKGROUND

Moss Adams, as the contracted internal auditor for the City of Santa Monica (the City), tested the internal controls over cash assets at selected City departments. The review took place between July and December 2016 and focused on testing the operating effectiveness of key controls over the City’s cash assets at various departments and locations.

The testing of internal controls for operating effectiveness was completed under the consultancy standards of the American Institute of Certified Public Accountants (AICPA). As such, this work was not an audit of internal controls that resulted in a formal opinion or other form of assurance. The specific methods used for testing controls over cash assets are presented in the Scope and Methodology section.

B. SCOPE AND METHODOLOGY

The scope of our review was the City’s current overall cash collection process and practices. However, we selected specific City departments and locations using a risk‐based approach that considered a variety of factors, such as the average deposit amount and other relevant observations or reported concerns.

The methodology that Moss Adams followed to apply a risk‐based approach to the scope of work included interviews with personnel involved in managing cash handling and revenue transactions at a sample of City departments/divisions. The departments selected for testing were as follows:

• Police Department (one location)

• Cultural and Community Services (three locations)

• Big Blue Bus (BBB) (one location)

• Planning and Community Development (PCD) (one location)

To test the operating effectiveness of internal controls over cash assets in the City, we performed a number of activities including the following:

• Gathered and reviewed relevant documentation including:

o City Administrative Instructions

o Departmental, division, or location‐specific cash handling policies and procedures

o List of locations collecting cash and payment types accepted

o Change fund balance information and custodian of record by location

o Petty cash fund balance information and custodian of record by location


• Performed unannounced cash counts that included the following elements:

o Onsite observation of physical access and security

o Compliance with City‐wide policies and procedures and cash handling best practices, including the following:

Reporting overages and shortages

Check acceptance

Credit card acceptance

Counterfeit examination

o Comparison of cash drawer contents, at a point in time determined by auditor, to recorded transactions

o Comparison of petty cash balance to petty cash records and documentation

o Comparison of change fund balance to transaction records

o Analysis of prepared deposit including comparison to receipts, transaction records, and City‐wide cash handling policies

o Observation of mail payment processing, if applicable

• Discussed the following cash handling activities with key personnel during site visits, as well as with Finance Department personnel regarding City‐wide elements:

o City‐wide, departmental, and location‐specific practices and relevant policies and procedures

o Training

o Segregation of duties

o System controls and access

o Monitoring by management

In certain locations, we judgmentally made adjustments to our methodology to accommodate specific business practices or circumstances encountered during unannounced site visits.

C. SUMMARY

The City has made progress designing and implementing internal controls related to the cash handling since the internal control review issued on March 17, 2015. For example, the City has updated its policies and procedures guiding operations at the Big Blue Bus’s counting room. Additionally, the Treasury Division has been working on updating the City’s cash handling policies and procedures. However, the City still has some gaps in its internal control environment regarding cash assets.

The results of our testing also revealed opportunities for the City of Santa Monica and its departments to further improve their cash handling practices. In particular, we observed weaknesses in the following areas:


• Physical security and restricted access to cash assets

• Accurate cash counts

• Check acceptance requirements

• Deposit preparation

• Reconciliations with transactions

• Overages and shortages

• Cash handling training

• Petty cash administration

• Segregation of duties and individual accountability

• Monitoring by management

• System controls and access

• Cash handling policies and procedures

• Mail payment processing

The overall conclusion of this review is that the City should continue its work to design and implement a strong internal control environment, as well as continue ongoing monitoring to assess and ensure the effectiveness of these controls. This work should be considered a priority and completed in phases over the next 12 months, as City resources are made available.

Moss Adams would like to thank the staff of Finance Department, Police Department, Cultural and Community Services, Big Blue Bus, and Planning and Community Development for their cooperation and assistance during our review.


II. RESULTS

Summary of On-Site Results by Location

Control Element Police

Dept. (1) CCS (1) CCS (2) CCS (3) BBB (1) Planning and

Comm. Dev. (1)

Physical Security and Access X X X X X X

Accurate Cash Counts X X X X N/A √

Credit Card Payments √ √ X √ X √

Check Acceptance Requirements √ N/A √ X X X

Counterfeit Requirements √ √ √ √ √ √

Deposit Preparation X X √ X N/A √

Reconciliation with Transactions X X X X N/A X

Overages and Shortages X X X X X X

Training X X X X X X

Petty Cash Administration N/A X √ X N/A N/A

Change Fund Administration √ X X √ N/A √

Segregation of Duties, Individual Accountability X X X X X √

Monitoring by Management X X X X X X

System Controls and Access X X X X X X

Policies and Procedures X X X X X X

Mail Payment Processing X X X X N/A X

Legend:

√ No exceptions noted X Opportunity for improvement


Areas with No Exceptions Noted

Counterfeit Requirements

• All of the locations we visited had some practices in place for inspecting for counterfeit cash. Of the sample bills we chose to test, no bills showed any indication of counterfeit. We noted the variation in practices across locations as an opportunity for improvement.

Opportunities for Improvement

Physical Security and Access

• Finding: Some locations lacked adequate physical security and lacked restricted access to cash assets. Physical security of cash assets helps protect the City from theft or other misappropriation of assets. In some locations, safe combinations have not been changed recently including following personnel changes. At another site, we observed an unlocked safe containing undeposited revenue and we found unaccounted for cash assets in an unlocked desk drawer. Moreover, we noted the safe combination was inappropriately shared with a staff member to facilitate our cash audit.

• Recommendations:

o Within City‐wide cash handling policies and procedures, outline requirements of physical security for all locations that collect cash and document minimum requirements and best practices. Include the following:

Limit the number of personnel with safe combinations.

Change the safe combinations that have not been changed recently and maintain a schedule to ensure that the combination is changed at least annually and after all personnel changes.

Require safes to be locked when not in use and utilize the drop safe feature whenever it exists.

Define acceptable locations for storage of undeposited cash during the business day and overnight.

• Finding: Not all locations provided adequate physical security for staff members. City employees who handle cash should have adequate physical protection and take safety measures to provide sufficient security to them and the cash they collect. In five locations, we observed weaknesses in physical barriers for staff members who handle cash, such as the lack of protective glass or adequate counter heights. Some locations did not have panic buttons or security cameras. We observed locations that did not provide restricted access to cash handling areas. For example, we observed one location that did not have a door or gate to prevent accessibility of customers to cash handling areas.



o The City should assess the adequacy of physical barriers between employees and customers at all cash handling locations. At all locations where there are weaknesses in physical barriers, install security improvements and redesign cash handling locations through planned remodels or when implementing office relocations.

o Within City‐wide policies and procedures, outline elements of physical security and access restrictions for all locations that collect cash and document minimum restrictions and best practices. Include the following:

Establish a minimum counter height to provide protection to employees handling cash.

Restrict access to cash handling areas through appropriate means such as keyed access, locks, or proximity cards.

Install and test panic buttons.

Define recommended practices including:

− Protective glass at counters

− Security cameras for cash handling areas

− Security cameras over safes or vaults, depending on value of assets stored

Accurate Cash Counts

• Finding: Not all cash counts performed were accurate in total and/or currency type. Cash counts are designed to provide assurance of accuracy and establish accountability. During our surprise cash counts, we found eight instances where the cash counts were not accurate in either total or currency type. In particular, at one location we found that a revenue envelope for one day was missing. At another location, we noted that the amounts recorded on the outside of the revenue envelopes did not reconcile to the system report or report stored inside the envelope. Due to system limitations in the revenue system, at two Big Blue Bus locations, we were unable to assess the accuracy of cash counts. In addition, we found that the City lacked a strong centralized process for tracking and monitoring errors in cash counts.


o Develop City‐wide policies and procedures to improve accuracy of cash counts, including documentation of counts and secondary sign‐offs.

o In conjunction with creating City‐wide policy and procedure, train staff on the importance of recording and verifying the accuracy of all remittance information including total by currency type as well as the grand total.

o Assign centralized responsibility for tracking all instances of deposits where errors are identified in either total and/or currency type. Deposit preparers and secondary reviewers should be referred to additional cash handling training or disciplinary action for repeated errors.


o Prior to expanding operations to collect cash at new locations, departments such as BBB should consider how to effectively implement internal controls such as establishing adequate accountability by location.

• Finding: The City lacks a process for periodically monitoring or testing cash controls at remote collection sites. Cash controls at the City’s remote cash collection sites are not consistently monitored and tested by the Finance Department. Of the remote cash collection sites observed, there were varied cash handling practices being followed. Internal controls were lacking, including such gaps as inadequate segregation of duties, missing reconciliation processes, and lax monitoring. Specific weaknesses in cash handling practices, such as infrequent deposits, missing restrictive check endorsements, and shared cash drawers, were also observed. Weaknesses in the administration of petty cash funds and change funds were also noted. Although petty cash is used for employee reimbursements under $50 and some locations administer relatively large petty cash funds, spot audits of petty cash funds are not performed. Similarly, the City does not maintain a comprehensive and up‐to‐date list of the petty cash and change funds amounts to ensure ongoing control by custodians of these funds. According to the Association of Certified Fraud Examiners (ACFE), surprise audits reduce fraud cost and duration, as well as deter potential fraudsters due to the actual or perceived expectation of oversight.1


o Implement a process to periodically monitor and test controls at remote cash collection sites, such as on‐site audits (observations) of cash handling procedures, surprise counts of tills, petty cash, and change funds, as well as the inspection of the contents of safes. When inadequate controls are identified through these tests, initiate appropriate follow‐up and resolution. See the Appendix for additional best practice guidance provided in Examples 1 through 3.

o Develop and maintain an ongoing list of petty cash and change fund amounts and their custodians.

Credit Card Payments

• Finding: Not all credit card payments complied with best practices. Appropriate credit card payment practices are important to avoid issues that may result in refused charges such as unsigned receipts or fraudulent card usage. Verifying customer identification prior to credit card payments is an important best practice that helps prevent refused charges. Most of the locations we visited reported that they do not check identification prior to processing credit card payments. Two locations we visited reported that they verify identification for all credit card payments. However, during our observation at one of these locations, we saw at least one instance in which identification was not verified for payment. In addition, we observed weaknesses in the reconciliation of credit card payments. For example, credit card payments did not reconcile to the day‐end transaction reports at one location, and signed receipts were missing at another location.

1 ACFE Report to the Nations on Occupational Fraud and Abuse 2014 Global Fraud Study



o Include requirements for accepting credit card payments, such as verifying identification, requiring signatures or PIN entries, and prohibiting cash back, in the update of City‐wide cash handling policies and procedures.

o As part of the reconciliation process, remind staff of the importance of verifying all transaction documentation at the end of each shift to prevent discrepancies.

Check Acceptance Requirements

• Finding: Not all check payments were consistently endorsed immediately upon acceptance. A restrictive endorsement typically includes the disclaimer, “for deposit only,” and does not allow the person depositing the check to receive cash back. Applying a restrictive endorsement immediately upon receipt provides the City greater protection against the City’s cash from being misappropriated. We observed weaknesses in check endorsement practices. Specifically, staff at one location reported endorsing all checks upon receipt, but all of the checks we observed were unendorsed. Another location does not endorse checks until the time of deposit preparation. Additionally, one location does not have an endorsement stamp and therefore all of their checks are unendorsed.


o Include requirements for accepting checks, such as immediate endorsement, in the update of City‐wide cash handling policies and procedures.

o Consider including inspection of accepted checks as part of the supervisor’s sign‐off and periodic spot checks to strengthen controls.

• Finding: Not all of the check payments consistently complied with the payable name requirements of the department. While departments reported that all checks received should be made payable to the “City of Santa Monica,” this requirement is not documented within City‐wide policy or procedure. At one location we observed four instances in which the checks were not made payable to the “City of Santa Monica.” Checks that are not written as payable to the City are more likely to be returned by the bank, thereby increasing the chance of the revenue going uncollected.


o Include requirements for accepting checks, such as “Payable To,” in the update of City‐wide cash handling policies and procedures.

o Emphasize to all staff with cash handling responsibilities the importance of verifying the “Payable To” name on checks.

o Verify that all outgoing City bills clearly state that customers must make payments payable to the City of Santa Monica.

o Establish a process for evaluating check acceptance exceptions including implementing required approvals.


Counterfeit Requirements

• Finding: Requirements for the inspection of counterfeit bills are not well-defined. Although we found that all of the locations we visited have some counterfeit inspection practices in place, these particular practices vary. Specifically, because the City lacks comprehensive cash handling policies and procedures, departments have not received guidance regarding the inspection of bills for evidence of counterfeit. As a result, departments varied in the denominations that they test and the manner for detection (counterfeit detector pen or black light device).


o Include counterfeit inspection requirements, such as the bill denominations and inspection methods, in the update of City‐wide cash handling policies and procedures.

Deposit Preparation

• Finding: Not all deposits are transported to the bank in a timely manner. The longer cash receipts are not in the custody of the bank, the more susceptible these cash receipts are to misappropriation and thus, best practices dictate depositing cash as frequently as is feasible given the amount of revenue collected and business operations. Staff reported transporting deposits with varying frequency—several locations reported transporting deposits daily, while others reported transporting deposits twice per week. During our observation, we noted instances in which locations did not comply with their own requirements for deposit frequency. We found that one location had 10 days of undeposited revenue and another location had 20 days of undeposited revenue stored in its safe. At another location, we found that only three deposits had been transported in the prior 6 days, despite the requirement for daily deposits per the location’s own operations manual. Additionally, we noted that at one location, only one individual is responsible for preparing deposits, which contributed to the backlog of undeposited revenue observed.


o Include deposit preparation requirements, such as the minimum frequency of deposit transport and appropriate methods for storage, in the update of City‐wide cash handling policies and procedures.

o Compile a list of the current deposit schedule City‐wide for all remote cash handling locations and monitor compliance. Instances of non‐compliance should be communicated to departmental management and promptly addressed.

o Provide departments with cash handling training and updated cash handling policies and procedures to remind staff of the importance of timely deposits.

• Finding: Not all collected revenue is transported in a secure manner. The method for transporting revenue for deposit varies by location. In accordance with best practices, some of the locations we visited are serviced regularly by a contracted armored car service. However, four of the locations we visited transport undeposited revenue in a less secure manner. When cash for deposit is not transported securely, it creates an increased risk to employees’ safety and may create a liability for the City.


• Recommendation:

o The Finance Department should work with applicable departments to determine the most economical, safe, and secure manner to transfer collected deposits to either the Finance Department or the bank.

Reconciliation with Transactions

• Finding: Not all of the transactions reconcile to the associated revenue collection system. The City does not have well‐documented, consistent, standardized processes governing the reconciliation process either at the end of shifts or between revenue collection and transaction records. As a result, we observed weaknesses in the reconciliation with transactions recorded at multiple locations. For example, at one location not all deposits are verified by a secondary reviewer to ensure accuracy of prepared deposits, and another location does not document any evidence of secondary reviews. We noted other shortcomings in the robustness of the reconciliation process. Specifically, we found that credit card payments did not reconcile at two locations we visited. At another location, we reviewed a discrepancy between the sales report and cash receipts that was noted on the reconciliation report. Staff reported that they investigated this error; however, they could not determine which representative made the error. The error was likely due to selecting an incorrect product code when processing sales, but could not be confirmed. Attempts to reconcile the inventory records to the transaction records at multiple locations were not possible due to the lack of necessary documentation to support transactions or complete inventory records.

Additionally, we observed instances where revenue was not recorded within the system. Two locations we visited conducted transactions outside of the system. We were advised that this issue occurred from backup a staff member, who did not have access to the revenue system, performing transactions from a shared drawer. In addition, at another location we identified two checks that did not reconcile to any available payment documentation and were not stored securely. If revenue is unrecorded or discrepancies are not effectively detected or monitored, the City faces risks of cash going missing through human error, theft, or fraud.


o Establish and implement process for reconciliation of transactions at the end each shift. This process should include elements such as a secondary review and approval and documentation of preparation and verification.

o Develop an alternative process for special circumstances to collect revenue outside of the revenue system that maintains internal controls. For example, staff without system access should collect money in a designated, locked cash box and record all transactions on paper receipts.

o Establish a policy requiring all departments to maintain records of all goods provided, fees charged, and services rendered and develop methods for efficiently and effectively recording this type of information and performing reconciliations within each department.


Overages and Shortages

• Finding: Not all staff performing cash handling duties follow a consistent City-wide process for reporting overages and shortages. The City has not documented the process for reporting overages and shortages and recording them in a separate account by division. We observed five locations where staff involved with cash handling responsibilities were not familiar with the City’s process for reporting overages and/or shortages. Two locations advised that if an overage occurs, cashiers force a balance by entering a charge into the system to eliminate the discrepancy. In addition, force balancing occurs when staff is unable to report the overage and/or shortage to a supervisor because they are absent. A well‐defined, widely communicated, and consistent process for reporting overages and shortages is important to provide accountability and prevent fraud through ongoing monitoring.


o Establish a process for reporting overages and shortages and include this process in the update of the City’s cash handling policies and procedures.

Training

• Finding: Not all staff performing cash handling duties have received formal cash handling training from the City or their department. The City has not provided formal comprehensive cash handling training in a number of years. Therefore, at all of the locations we visited, we found employees handling cash who had not attended any formal cash handling training from the City. Instead, most of these staff reported receiving informal training from their department. These staff members, without formal training, are currently responsible for deposit preparation, processing cash transactions, and various activities involved in counting cash. Without providing formal cash handling training to all employees who perform cash handling duties, the City does not have reasonable assurance that its employees are appropriately safeguarding the City’s assets and revenue. In particular, employees may not be fully aware of the standards to which they and other employees should adhere nor are employees able to effectively identify and protect themselves and the City from fraud, waste, and abuse.


o Provide comprehensive standardized training for all individuals involved in cash handling, including part‐time employees and any staff assigned as backup. Include the following elements in cash handling training:

Definition of cash (bills, coins, checks, credit and debit card payments)

Payment acceptance requirements:

− Counterfeit detection

− Check acceptance

− Secure debit and credit card payments

Performing transactions (receiving payment, recording payment, giving change)


Balancing at start and end of shift

Reconciliation and deposit preparation


Physical security and access controls

Segregation of duties and individual accountability

Identifying and reporting issues

o To provide easier access to cash handling training, Treasury could develop a cash handling training as an interactive webcast that can be viewed by any employee at any location at any time. This would allow training to be more readily available to employees throughout the year and may allow Treasury to customize different training types such as an initial and a refresher training, training geared towards those employees mainly dealing with cash or those employees mainly dealing with accounting transactions, and training geared towards volunteers or vendors.

o Update the City’s cash handling policy and procedure to include the following elements:

Definition of cash handling duties to include the process of receipt of cash in payment for goods, services, fees, or taxes; applying these payments to customer or City accounts; balancing cash batches; completing documents related to remittance batches; preparing or reviewing deposits; reconciling customer or City accounts; and maintaining a petty cash or change fund.

Requirement for all individuals who perform cash handling duties on behalf of the City, including full‐time, part‐time, and temporary employees, as well as any revenue‐collecting contractors, to complete cash handling training within 30 days of assuming these responsibilities.

Requirement for all aforementioned individuals who perform cash handling duties on behalf of the City to complete a refresher cash handling training every two years or as directed due to non‐compliance.

Procedures for monitoring cash handling training attendance records to ensure ongoing compliance.

o Work collaboratively to assign and perform the responsibilities related to this training. For example, the following responsibilities could be assigned as follows:

Treasury:

− Provides cash handling training

− Periodically monitors training compliance

Human Resources:

− Tracks training certification including notifying departments of non‐compliance and providing reminders for refresher course


Departmental Management:

− Identifies job titles and individuals who perform cash handling duties

− Notifies Human Resources of new hires requiring training

o Consider pursuing electronic options for tracking training to make this a more efficient process.

Petty Cash Administration

• Finding: Not all locations’ petty cash funds match the City’s records of petty cash funds. For the three locations we were able to assess, we noted discrepancies between the City’s petty cash fund records and the petty cash funds observed at the locations. At one location, the amount we observed did not match the amount recorded in the City records. At another location, we identified an invoice for the receipt of petty cash; however, we did not observe any petty cash currency. Additionally, at another location we did not observe a petty cash fund on‐site and staff reported that one did not exist; however, City records indicated an active petty cash fund existed. Without ongoing monitoring and up‐to‐date recordkeeping of petty cash funds, there is a greater risk of fraud, waste, and abuse.


o Work with departments to resolve the identified discrepancies.

o Work with departments to ensure that the petty cash fund amounts are adequate and appropriate.

o Update the City’s petty cash fund records to reconcile specific locations’ records and City records.

o Strengthen process for overseeing petty cash funds to effectively monitor petty cash funds and determine any that are no longer in active use.

o Increase ongoing oversight over petty cash funds and monitor remote cash handling locations to ensure the appropriate use and authorization of all petty cash funds.

o Advise departments to maintain the memos authorizing each petty cash fund in its respective bag to avoid uncertainty.

o Consider modifying accounting practices to record each petty cash fund separately by division to increase accountability.

Change Fund Administration

• Finding: Not all locations’ change funds match the City’s records of change funds. At two of the five locations we were able to assess, we noted discrepancies between the City’s change fund records and the change funds observed at the locations. At one location, we observed a change fund; however, the City does not have any record of the location’s change fund. At another location, there was an overage in the cash drawer and therefore the change fund did not reconcile to City records. Additionally, we found that one location reported that its change fund is not adequate and,


therefore, the staff at this location use undeposited revenue stored in the safe to provide additional change to cashiers. Using undeposited revenue to make change creates opportunities for shortages due to errors or misappropriation. If change funds are not counted and verified on a regular basis, cash could go missing without management knowledge, either through human error, theft, or fraud.


o Work with departments to resolve the identified discrepancies.

o Update the City’s change fund records to reconcile locations’ records and City records.

o Work with departments to ensure that the current change fund amounts are adequate and appropriate. For example, Accounts Payable should meet with the Swim Center to discuss options for meeting their change fund needs particularly during the summer.

o Strengthen process for overseeing change funds to be robust enough to effectively monitor all change funds and determine any that are no longer in active use.

o Increase ongoing oversight over change funds and monitoring remote cash handling locations to ensure the appropriate use and authorization of all change funds.

o Advise departments to maintain the memos authorizing each change fund in its respective bag to avoid uncertainty.

o Include change fund administration in the update of the City’s cash handling policies and procedures.

o Consider modifying accounting practices to record each change fund separately by division to increase accountability.

Segregation of Duties and Individual Accountability

• Finding: Controls to ensure adequate individual accountability are not in place at all locations. During our fieldwork, we identified weaknesses in controls that help provide accountability for each individual involved in cash handling. At three locations, we observed cashiers sharing cash drawers either throughout the day or when staff filled in as backup. We observed staff at other locations conducting transactions under shared logins. Additionally, we noted the absence of mitigating controls such as performing cash counts between shift changes. When the cash received is co‐mingled by any of these methods, it is difficult to determine the individual who was responsible if cash is short or does not reconcile.


o Establish minimum standards for individual accountability and include in update of City‐wide cash handling policies and procedures.

o For certain locations, ensure that all cashiers have their own logins and communicate the importance of working only under own login. In addition, obtain a backup cash drawer to facilitate prompt switchover between cashiers.

o Develop a process for balancing transactions at the end of shift including a documented sign‐off and include this within the City’s update of its cash handling procedures.


o Implement individual cash drawers wherever possible. Where shared drawers continue to be used, develop a simple form and require that each individual count the cash drawer contents at the end of each shift and have a secondary individual verify and sign.

• Finding: Not all cash handling duties are appropriately segregated. We identified weaknesses in segregation of duties at four of the locations we visited. For example, at two locations, we found that the individuals who prepare deposits also collect and record revenue on a daily basis. Additionally, we found that at one location an individual is solely responsible for the collection of fees and administering the associated services, thereby creating an opportunity to misappropriate funds without detection. Similarly, we noted weaknesses in segregation of duties relating to other activities such as mail payment processing. Without adequate segregation of duties in cash handling, there is an increased risk of errors or misappropriation of funds.


o Obtain and tailor a segregation of duties list/matrix based on readily available best practice guidance. For example, address assignment of responsibilities for billing versus receiving revenue, performing transactions versus adjusting fees or charges and voiding transactions, as well as opening mail payments versus processing mail payments.

o Establish list of possible mitigating controls to employ when limited personnel are available to properly segregate duties.

o See recommendations for Mail Payment Processing and System Control and Access.

Monitoring by Management

• Finding: The City lacks standards regarding departmental responsibilities for monitoring cash handling and revenue collection. During our fieldwork, we observed weaknesses in monitoring by management of cash handling and revenue collection. Strong controls in monitoring cash handling activities provide prevention and detection to decrease the risks associated with errors or misappropriation of funds. We observed several instances in which management does not perform monitoring for voided transactions, refunds, adjusted fees, deleted transactions, revenue collection trends, and overages and shortages. For example, at one location the day‐end report generated by the system does not include all refunds, thereby creating a risk of inappropriate refunds going undetected. Additionally, we observed the lack of monitoring over specific activities at certain locations. For example, one location does not compare facility usage to revenue collection to ensure full revenue collection. Similarly, we observed significant outstanding balances for individuals who are provided with continued usage. Delays in balance collection increase the chance that fees may not be collected.


o In conjunction with other recommended changes to the cash handling policies, update the City’s cash handling policies and procedures to establish minimum standards and expectations for monitoring cash handling and revenue collection.


o Assign roles and responsibilities for monitoring cash handling and revenue collection, particularly at remote locations. Once these expectations are established, they should be documented in department‐specific policies and procedures.

o Specific departments should revise reports, such as day‐end reports, to promote accountability and facilitate ongoing monitoring

o Establish minimum requirements relating to accounts receivable, such as roles and responsibilities, and include these in the update of City‐wide policies and procedures. Also, department‐specific practices, such as denying facility access to individuals with outstanding balances, should be documented.

System Controls and Access

• Finding: Not all systems used by City departments have adequate system controls or appropriately restrict access. In addition, the City’s policies and procedures do not address system control and access, such as access levels and robust system implementation. At all of the locations, we observed weaknesses in the access restrictions and system controls. Based on departments’ system configurations, we found employees who collect cash are able to perform certain activities without the involvement or approval of supervisors. Specifically, we found numerous individuals whose access was not restricted and do not require additional approvals from management for specific transactions such as voids, fee adjustments, or refunds. Additionally, at two locations, employees work under another individual’s username and password or under a single login. Moreover, some systems do not record or generate reports with adequate detail and accuracy. For example, we observed two locations where transactions performed at more than one site were recorded under a single site. We also found that the system reports at one location do not show voided permits or include payment references for all transactions. Without adequate system controls and access restrictions, accountability is limited and opportunities are created for the misappropriation of funds without detection.


o Establish minimum requirements for system access and control and include in the update of City‐wide cash handling and revenue policies and procedures. For example, implement best practices in system access and control such as:

Restrict system access to required staff.

Limit user access to certain functions including fee adjustment, void, and transaction deletion.

Implement additional controls, such as data entry review, secondary approval process, and ongoing monitoring around fee schedule updates, fee adjustments, voids, and refunds.

o Additionally, certain locations should consider implementing the following improvements:

In collaboration with specific departments’ system administrators and the software vendors, explore the following:


− Limit the access to certain functions, such as overrides, to certain roles.

− Create distinct logins for all individuals performing cash handling duties.

− Add “payment reference” as a required field.

− Modify reports to enhance accountability, such as including the transaction count by payment type to the day‐end report.

− Until preventative access restrictions can be effectively implemented, establish detective processes to monitor certain activities, such as fee adjustments and voids, on an ongoing basis at each location as well as centrally.

For certain locations with a significant number of temporary employees, collaborate with the IT Department to create a back‐up login account for individuals with expired passwords.

Policies and Procedures

• Finding: The City’s cash handling policies and procedures are not up-to-date or comprehensive. The City has not provided robust policies and procedures to guide cash handling practices throughout the City. For example, they do not adequately address certain issues, practices, and processes such as definition of cash, transaction reconciliation, and reporting overages and shortages. The policies also do not set forth minimum requirements for physical security, segregation of duties, and cash handling monitoring by management. In the absence of City‐wide guidance, some departments have developed their own policies and procedures to guide cash handling, while other departments have not. Without adequate, standardized direction, practices and policies are inconsistent across departments and weaknesses in controls exist and increase the chance of non‐compliance.


o In conjunction with assistance provided through its internal audit program, the City should revise, update, and distribute its cash handling policies and procedures to provide comprehensive direction for all cash handling activities. The policies and procedures should include the following topics:

Definition of cash (bills, coins, checks, credit and debit card payments)

Payment acceptance requirements (counterfeit inspection, checks, debit and credit card payments)

Performing transactions (receiving payment, recording payment, giving change)

Balancing at start and end of shift

Reconciliation and deposit preparation


Voids, fee adjustments, and refunds


System controls and access

Physical security and access controls

Best practices in mail payment processing

Best practices in segregation of duties and individual accountability

Minimum requirements for system control and access

Minimum requirements for revenue and cash handling monitoring by management

Identifying and reporting issues

o Following the development of City‐wide cash handling policies and procedures, departments or locations with specialized operations or unique practices should develop their own specific policies and procedures. Any variances from City‐wide cash handling policies and procedures should be provided to the Finance Department for review to ensure adequate internal controls exist.

Mail Payment Processing

• Finding: Control weaknesses exist in locations’ mail payment processing, and the City has not established standardized practices for processing mail payments. Departments lack City‐wide guidance about how to process mail payments and, as a result, during our on‐site visits, we observed weaknesses in controls at the five locations that process these payments. At two locations, mail payments are opened and processed by one individual, thus lacking adequate segregation of duties between mail payment handling and payment processing. At two other locations, there is no tracking or documentation in place to record evidence of mail payments received. Additionally, some locations co‐mingled payments received by mail and in person. Moreover, specific locations receive large volumes of mail payments, which may result in delays in processing, thereby increasing the chance that checks will be returned for insufficient funds. Failure to document the receipt of mail payments, maintain separate mail payment batches, adequately segregate duties, and process payments in a timely manner all increase the risk of loss, theft, or fraud.


o Document and recommend implementation of best practices for mail payment processing including the appropriate segregation of duties, logging all mail payments received, and processing mail payments in separate batches.

o Update cash handling policies and procedures to include required minimum controls over mail payments such as:

Maintaining mail logs of mail payments

Preparing mail payments in separate batches

o Departments that receive large volumes of mail payments should explore other opportunities to increase both controls regarding this process as well as efficiency such as online systems or software allowing online payments and remote check processing.


III. APPENDIX: EXAMPLE FORMS AND

PROCEDURES

EXAMPLE 1 – UNANNOUNCED CASH COUNT PROCEDURES

• Present department staff/change fund custodian with memo from Finance Department regarding unannounced cash counts.

• Inquire about number of change funds and/or petty cash at the location.

• Ask for copy of departmental cash handling procedures, if applicable.

• Review cash handling training records for staff and advise about staff in need of training.

• For each change and petty cash fund:

o Change fund: Run register total/cash edit listing to show any transactions logged up to this time.

o Petty Cash: Obtain log of outstanding funds.

o Count and log cash amounts, in the presence of department staff member.

o Department witness will also sign the log.

o Use comment section to detail any information that needs to be reviewed or elevated.

• Advise the staff member that a report of the count will be delivered to the department shortly. Any irregularities need to be reported immediately and a memo should be submitted to the department head.


EXAMPLE 2 – CHANGE FUND AND CASH DRAWER AUDIT

Change Fund Location Change Fund Amount

Change Fund Custodian Department Staff Audit Staff (Audit Supervisor, if applicable)

Audit Date (Start and End Time)

Bill Currency

Coin Currency Denomination Count Value

Denomination Count Value

Coin Rolls Count Value

$100.00

$

$1.00 $

Quarter (40#)

$ $ 50.00

$

$ 0.50 $

Dime (50 #)

$

$20.00

$

$0.25

$

Nickel (40#)

$ $ 10.00

$

$0.10

$

Penny (50 #)

$

$ 5.00

$

$0.05

$

Rolled Coin Subtotal

$ $ 2.00 $

$0.01

$

$1.00

$

Loose Coin Subtotal $ Bill Currency Subtotal

$

Coin Subtotal

$

Payment Method

Revenue Recorded Difference Bills & Coins − Bills & Coins = Bills & Coins Checks (count, amount)

− Checks (count, amount)

=

Checks (count, amount)

Over/Short Amount $

Credit Cards (count, amount)

−


=


-

Grand Total $


OBSERVATIONS:

a) Custodian received cash handling training?

Yes No Not Applicable If no, explain:

b) Cash drawer locked? Yes No Not Applicable If no, explain: c) Individually assigned drawer? Yes No Not Applicable If no, explain: d) All checks meet requirements? Yes No Not Applicable If no, explain: e) All bills of $50 or greater

negative for signs of counterfeit?


f) All voids, refunds, adjustments appropriately authorized?


g) Overnight storage for undeposited revenue is secure?


COMMENTS: Department Staff (Signature) Date Audit Staff (Signature) Date Audit Supervisor (Signature) Date


EXAMPLE 3 – PETTY CASH AUDIT

Petty Cash Fund Location Petty Cash Fund $ Petty Cash Fund Custodian Department Staff Audit Staff Audit Supervisor Audit Date Start Time End Time Petty Cash Count Total $ Cash $ Coin $ 1) Were all petty cash

transactions $50 or less?

Yes No Not Applicable

If no, explain finding results: 2) Were any ineligible

petty cash expenses included in the receipts?


If no, explain finding results: 3) Is the petty cash fund

kept in a locked and secure location?


If no, explain finding results: 4) Did all cash receipts

attached to a petty cash form include authorized signature, account coding, and description of expense?


If no, explain finding results: 5) If a receipt was lost or

stolen, was the lost/missing receipt form completed?


If no, explain finding results: 6) Were any receipts

approved by the same employee who was reimbursed or by the petty cash fund custodian?


If no, explain finding results: Department Staff (Signature)

Date Audit Staff (Signature)

Audit Supervisor (Signature)

Date Date

CITY OF SANTA MONICA · City of Santa Monica Internal Controls Testing: Cash Handling Final Report...

Documents

Transcript of CITY OF SANTA MONICA · City of Santa Monica Internal Controls Testing: Cash Handling Final Report...